ISACA
ISACA® (www.isaca.org) represents the global workforce advancing trust in technology. For more than 55 years, ISACA has empowered its global community of 195,000+ members with the knowledge, credentials, training and network they need to thrive in fields like information security, governance, assurance, data privacy, risk management and emerging tech. With a presence in 195 countries and with nearly 230 chapters worldwide, ISACA offers resources tailored to every stage of members’ careers—helping them to thrive in a rapidly changing digital landscape, drive trusted innovation and ensure a more secure digital world. Through the ISACA Foundation, ISACA also champions IT education and career pathways for underrepresented and underresourced communities, fostering a diverse and inclusive technology workforce.www.isaca.org
34
MENTIONS
19
EPISODES
11
PODCASTS
Search complete. 34 mentions across 19 episodes found for "ISACA".
Sep 17, 2026
Sec GuyHOST
ISO is how you survive the audit.
Sec GuyHOST
Finally, we have COVID, which was created by ISACA, the same organization that writes your exam.
Sec GuyHOST
COVID is designed to bridge the gap between IT operations and overarching business goals, ensuring every dollar spent directly supports a business objective.
Sec GuyHOST
But who decides which framework to use? Most engineers fail here because they think the security team makes this choice.
Sec GuyHOST
Procedures are the step-by-step manuals.
Sec GuyHOST
They tell the firewall engineer exactly which buttons to click to turn on that encryption.
Sec GuyHOST
ISACA loves to test your understanding of this hierarchy.
Sec GuyHOST
If they ask which document is high level and mandatory, the answer is policy.
Sec GuyHOST
Let's get to work.
Sec GuyHOST
We need to understand ISACA's core philosophy.
Sec GuyHOST
ISACA is the governing body for the CISM, and they demand a strict separation of duties.
Sec GuyHOST
On the left, we have IT operations.
Sec GuyHOST
This is the engineering team.
Sec GuyHOST
You must justify every single dollar of your security program based on the current risk environment.
Sec GuyHOST
ISACA loves this concept because it forces constant, rigorous business alignment.
Sec GuyHOST
Now, let's look at a real-world scenario.
Sec GuyHOST
Imagine we are in an economic recession.
Sec GuyHOST
A technician sees a critical software flaw and immediately demands an emergency patch, even if it takes down the payment server.
Sec GuyHOST
A CISO looks at that same flaw and asks, does this actually threaten our core business operations? To answer that, we use three distinct metrics that ISACA loves to test.
Sec GuyHOST
Risk capacity, risk appetite, and risk tolerance.
Sec GuyHOST
Risk capacity is the absolute maximum amount of risk a company can absorb before it goes completely bankrupt.
Sec GuyHOST
To pass the CISM exam and survive the CISO chair, you must master the science of measurement.
Sec GuyHOST
ISACA defines three specific indicators, KGIs, KPIs, and KRIs.
Sec GuyHOST
Let's break them down by time, past, present, and future.
Sec GuyHOST
First, the past, KGI, key goal indicator.
Jake BernardesGUEST
So I would get out there, right? Go join local communities.
Jake BernardesGUEST
ISACA and ISSA chapters all over the world.
Jake BernardesGUEST
Go join those kind of communities in groups or B-Sides events or go to conferences.
Jake BernardesGUEST
Network via LinkedIn.
17 MINS LATER
Jake BernardesGUEST
I think the most important thing to anybody in business, not just in cybersecurity, is your network.
Jake BernardesGUEST
So I would get out there, right? Go join local communities.
Jake BernardesGUEST
ISACA and ISSA chapters all over the world.
Jake BernardesGUEST
go join those kind of communities in groups or B-Sides events or go to conferences, like network via LinkedIn, reach out to people who you think are interesting and ask them if you can have 30 minutes to learn from them.
Menno van der HorstHOST
Cool.
Ramsés GallegoGUEST
I'm an ISACA Hall of Fame, president of the ISACA Barcelona chapter, and again, super excited to be with you this morning, guys.
Menno van der HorstHOST
Awesome, it's an honor.
Menno van der HorstHOST
So, uh, I have Quint as well, Quint Ketting, our, uh, regular table guest, my co-host.
7 MINS LATER
Ramsés GallegoGUEST
[laughs] So two questions, right? Is it good for right now, and is it good for tomorrow?
Quint KettingHOST
Exactly.
Quint KettingHOST
And, and I think, uh, and that's why I wanted to switch gears, because, um, you are also, uh, a leader in the ISACA community, right?
Ramsés GallegoGUEST
Yes.
AamirGUEST
That is clear.
AamirGUEST
I mean, like we talk about the ISACA, For CISA, they have AIA.
AamirGUEST
For CSM, they have AISM.
AamirGUEST
For the series, they have AIR.
speaker_1HOST
Yes.
speaker_1HOST
Stuff like, um, CompTIA's SecAI+ or ISACA's AAISAM.
speaker_0HOST
Mm.
speaker_1HOST
These rely really heavily on multiple choice questions, just, you know, A, B, C, or D.
Lisa CookHOST
My name, again, is Lisa Cook.
Lisa CookHOST
I'm the GRC Principal Researcher at ISACA.
Lisa CookHOST
And thank you so much for joining us.
Lisa CookHOST
Thank you, Lisa.
9 more episodes mention ISACA.
Create an account to see the whole feed, search across every transcript, and follow the entities you care about.